0ace1841939b63f43f033ab096b61846f373b359d9c927096752d88c437bcbb6

Analysis

max time kernel
91s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 16:06

Target

VirusShare_15b406601992e80b9f5a22448a7df1f2.exe
Size

58KB
MD5

15b406601992e80b9f5a22448a7df1f2
SHA1

5213baac74fd04cdd846efb1656cd70a423d130d
SHA256

0ace1841939b63f43f033ab096b61846f373b359d9c927096752d88c437bcbb6
SHA512

10ad5e8047a459569d0ac3baeb3db414a6459a0222b65e4bbb39c45eba01fa59679f5d2fc785eafd53a35f5d01f7261d8bbd4f5ecd019b1401ad69d260279b85
SSDEEP

1536:p3kwY3zkrGpVKMZKpJFyO6tXp3EoIDQ4KSk:p32JK0SFb6tXW7CS

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
836	VirusShare_15b406601992e80b9f5a22448a7df1f2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3292	836	WerFault.exe	84

C:\Users\Admin\AppData\Local\Temp\VirusShare_15b406601992e80b9f5a22448a7df1f2.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_15b406601992e80b9f5a22448a7df1f2.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 412
  2⤵
  - Program crash
  PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 836 -ip 836
1⤵
PID:1972

memory/836-1-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/836-0-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/836-2-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/836-4-0x00000000004B0000-0x00000000004C9000-memory.dmp

Filesize
100KB

Download
memory/836-3-0x0000000077A02000-0x0000000077A03000-memory.dmp

Filesize
4KB

Download
memory/836-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/836-6-0x00000000004B0000-0x00000000004C9000-memory.dmp

Filesize
100KB

Download